CVE-2026-46521

Analyzed Analyzed - Analysis Complete

Out-of-Bounds Write in ImageMagick via LZMA Compression

Publication date: 2026-06-10

Last updated on: 2026-06-11

Assigner: GitHub, Inc.

Description

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-48 and 7.1.2-23, when using LZMA compression in the MIFF encoder an out of bounds write can occur due to a missing check. This issue has been patched in versions 6.9.13-48 and 7.1.2-23.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-10

Last Modified

2026-06-11

Generated

2026-07-01

AI Q&A

2026-06-11

EPSS Evaluated

2026-06-30

NVD

CVE-2026-46521

Affected Vendors & Products

Vendor	Product	Version / Range
imagemagick	imagemagick	to 6.9.13-48 (exc)
imagemagick	imagemagick	From 7.0.0-0 (inc) to 7.1.2-23 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-787	The product writes data past the end, or before the beginning, of the intended buffer.
CWE-252	The product does not check the return value from a method or function, which can prevent it from detecting unexpected states and conditions.
CWE-131	The product does not correctly calculate the size to be used when allocating a buffer, which could lead to a buffer overflow.
CWE-835	The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.

Attack-Flow Graph

Executive Summary

This vulnerability exists in ImageMagick, a free and open-source software used for editing and manipulating digital images. Specifically, prior to versions 6.9.13-48 and 7.1.2-23, when using LZMA compression in the MIFF encoder, an out of bounds write can occur due to a missing check.

An out of bounds write means that the software writes data outside the allocated memory buffer, which can lead to unpredictable behavior or crashes.

This issue has been fixed in versions 6.9.13-48 and 7.1.2-23.

Impact Analysis

The vulnerability can impact you by causing an out of bounds write when processing images with LZMA compression in the MIFF encoder, which may lead to application crashes or instability.

According to the CVSS v3.1 score of 5.5 with an attack vector of local and low privileges required, the impact is primarily on availability (A:H), meaning it can cause denial of service or disruption of service.

There is no direct impact on confidentiality or integrity.

Mitigation Strategies

To mitigate this vulnerability, update ImageMagick to version 6.9.13-48 or later, or version 7.1.2-23 or later, where the issue has been patched.

Compliance Impact

The provided information does not specify any direct impact of this vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.

Detection Guidance

This vulnerability affects specific versions of ImageMagick prior to 6.9.13-48 and 7.1.2-23. To detect if your system is vulnerable, you should first check the installed version of ImageMagick.

Run the command `convert --version` or `magick --version` to determine the installed ImageMagick version.

If the version is older than 6.9.13-48 or 7.1.2-23, your system is potentially vulnerable to this issue.

Since the vulnerability requires local user interaction and involves the MIFF encoder with LZMA compression, monitoring for usage of MIFF images compressed with LZMA may help detect exploitation attempts.

No specific network detection commands or signatures are provided in the available resources.

Hi! I’m here to help you understand CVE-2026-46521. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70